Defending Against Data Leakage Through Covert Channels

Insiders can compromise critical systems and leak sensitive information using unauthorized applications and tools that are classified by McAfee as potentially unwanted programs (PUPs). Savvy criminals employ PUPs that use data-hiding techniques, including steganography, facilitating stealthy exfiltration from the enterprise.

In this webinar, you’ll learn how McAfee and Allen Corporation’s cyber security division, WetStone Technologies, are working to:

• Provide a joint McAfee-Allen solution that detects and blocks the execution of PUPs particularly relevant to insider attacks.
• Enable digital investigators to search for evidence in data breach incident investigations, revealing the use of these malicious data-hiding tools.
• Leverage McAfee endpoint software to pre-empt such dangerous software from executing.

Over 90% of the world’s data has been generated in the last few years. Accompanying this rapid growth in data comes exponential risks, as witnessed by the spike in cyber attacks of which no organization seems immune. The financial rewards gained by the perpetuators of cyber attacks is blatant, and this is driving continued attacks on companies containing massive amounts of consumer data. For these companies securing data is only half the battle. The risks can be greater when data is transmitted externally, hence it is critical that organizations know where sensitive data is going, how it is being transmitted, and how it is being handled and stored.

On this webinar our panel of experts will discuss some of the best practices organizations can consider to reduce the risk of suffering from a data breach, and to proactively prepare for any subsequent breach that could happen.

Fraud detection is a classic adversarial analytics challenge: As soon as an automated system successfully learns to stop one scheme, fraudsters move on to attack another way. Each scheme requires looking for different signals (i.e. features) to catch; is relatively rare (one in millions for finance or e-commerce); and may take months to investigate a single case (in healthcare or tax, for example) – making quality training data scarce.

This talk will cover a code walk-through, the key lessons learned while building such real-world software systems over the past few years. We'll look for fraud signals in public email datasets, using IPython and popular open-source libraries (scikit-learn, statsmodel, nltk, etc.) for data science and Apache Spark as the compute engine for scalable parallel processing.

David will iteratively build a machine-learned hybrid model – combining features from different data sources and algorithmic approaches, to catch diverse aspects of suspect behavior:

Apache Spark is used to run these models at scale – in batch mode for model training and with Spark Streaming for production use. We’ll discuss the data model, computation, and feedback workflows, as well as some tools and libraries built on top of the open-source components to enable faster experimentation, optimization, and productization of the models.

Humans have been protecting our complex network infrastructures for decades with varying degrees of success, while eusocial insects such as ants are capable of withstanding countless attacks on their networks.

This presentation is about what ants in general and Leafcutter Ants in particular approach security and how we can learn from these survivors of millions years of warfare.

You will learn:
-How social insects (ants) are dealing with predictive analysis
-Applying the defense mechanism of ants on threat intelligence
-How information sharing and communication can lead to better security
-Data and Identity Management

This case study is framed in a multinational company with 300k+ employees, present in 100+ countries, that is adding one extra layer of security based on big data analytics capabilities, in order to provide net-new value to their ongoing SOC-related investments.

Having billions of events being generated on a weekly basis, real-time monitoring must be complemented with deep analysis to hunt targeted and advanced attacks.

By leveraging a cloud-based Spark cluster, ElasticSearch, R, Scala and PowerBI, a security analytics platform based on anomaly detection is being progressively implemented.

The General Data Protection Regulation (GDPR), a set of rules governing the privacy and security of personal data that is being implemented by the European Commission, is going into effect in May, 2018.

This means your company, and every other company in the world are considering:
- Does GDPR affect my organization and how
- What are the cybersecurity and privacy implications of GDPR
- What happens if I don't comply
Join this panel of top privacy and security experts as they discuss the state of identity, privacy and cyber security in the context of GDPR.

Nicola Franchetto will discuss in a practical and business oriented way, the new provisions of the GDPR and how the PLA Code of Conduct supports compliance with the forthcoming EU Data Protection Legislation. More precisely, Franchetto will highlight the true privacy compliance “game changers” introduced by the GDPR and offer the audience practical inputs on how to set up a sound and effective corporate Data Protection Compliance Programme, which will also include having a PLA in place with Cloud Service Providers.

- InnoSec is the winner of the EU commission Horizon 2020 grant based on its innovation in GDPR and cyber risk -

GDPR is an urgent issue that has companies scrambling to be compliant by May of 2018. Any organization that processes EU citizen data is in scope and the penalties are severe.

Alignment with the requirements can reduce the chances of triggering a Data Protection Authority (DPA) to investigate a company’s privacy practices after the GDPR takes effect in May 2018. DPAs can impose a fine on companies of up to 4% of annual global revenues for egregious violations of the GDPR. Member states can also add to these fines. The Netherlands, for instance, has more than doubled its own fining capacity to 10% of annual revenues. European privacy advocates are pressuring DPAs to fully exercise these new powers after May 2018.To manage this risk, multinationals should have a means to demonstrate alignment with the GDPR requirements and communication of this program with DPAs that have jurisdiction over their major European operations.

InnoSec’s GDPR solution provides privacy impact and risk assessments which measure the confidentiality and integrity of the system and the risk associated to it meeting articles 1,2, 5, 32, 35 and 36. Additionally, we provide a readiness gap analysis for managing, planning and budgeting for GDPR.

Most e-commerce, educational and multi-national organizations process EU citizen data and are in scope for GDPR. Moreover, most organizations are not ready according to Gartner and his means the race to the finish line requires as much automation as you can afford. InnoSec provides a means for companies to save money and time with their GDPR assessment and gap analysis offering.. Our GDPR offering automates the assessment process and provides a gap analysis readiness feature, that also ensures that organizations can plan, budget and manage their GDPR program.

Our panel of data protection experts will be discussing the compliance considerations that you need to be assessing for May 2018 along with suggesting next steps from a cyber and general security standpoint.

We'll also be asking YOU at what stage you're at in terms of your preparations via a series of interactive benchmarks as we go through the session to get a sense of where the security community is at in terms of preparations.

-------------

GDPR and its May 2018 deadline are now fully the minds of the vast majority of security professionals and with massive fines on the horizon for non-compliance, now is a better time than ever to get to grips with the legislation and ensure that your organisation is secure and compliant.

It’s vital that your business has carried out the relevant preparations for compliance by then to make sure you don’t get whacked with a huge fine of up to £15m or 4% of your organisation’s global annual turnover.

Not only are there potentially huge financial repercussions, but leaving your business open to attack and your customers at risk can cause serious reputational damage.

The EU General Data Protection Regulation (GDPR) was designed to harmonize data privacy laws across Europe, to protect and empower all EU citizens’ data privacy, and to reshape the way organizations across the region approach data privacy. Acknowledging identity threats like phishing and man-in-the-middle attacks, the GDPR applies to all companies processing and holding the personal data of those residing in the European Union, regardless of the company’s location.

An excerpt from the GDPR describes authentication as ‘key to securing computer systems’ and as the first step ‘in using a remote service or facility, and performing access control’. The document also outlines various GDPR-compliant authentication solutions, such as smart card, OTP push apps, and FIDO Universal 2nd Factor (U2F).

Yubico’s enterprise solution - the YubiKey - combines support for OpenPGP (an open standard for signing and encryption), FIDO U2F (a protocol that works with an unlimited number of applications), and smart card / PIV (a standard that enables RSA or ECC sign/encrypt operations using a private key stored on the device) all in one multi-protocol authentication device. This makes it a strong and flexible solution for companies required to comply with GDPR. Attend this webcast and learn:

•How GDPR will impact the way organizations worldwide store and access the personal information of EU citizens
•How to leverage open standards to achieve GDPR compliance for strong authentication
•How a multi-protocol authentication device protects organizations from phishing and man-in-the-middle attacks

Mobile devices have won. Whether it’s a cell phone or tablet they are the device of choice for users wanting to access corporate resources. This webinar will discuss the options for supporting these devices as a business imperative. At one end of the spectrum there’s the “corporate device only” approach, at the other end is a BYOD approach. Either approach is acceptable provided it’s based on a risk assessment and adheres to corporate policy.

This presentation will address the security issues organizations are facing in supporting access to corporate resources from users with mobile devices. Join us as we discuss the importance of establishing a secure BYOD strategy, the security controls you will need to have in place and the need for strong authentication.

About the Presenters
Graham Williamson has 25 years experience in the Information Technology industry with expertise in identity management and access control, enterprise architecture and services-oriented architecture, electronic commerce and public key infrastructure, ICT strategy development and project management.

Andrew Ferguson is one of the founders and key shareholders of Internet Commerce Australia (ICA) and a shareholder of KuppingerCole (Asia Pacific). He is a Senior Consultant with KuppingerCole with a 20 year career in Identity and Access Management and a total of 40 years in the IT sector. He has worked for the UK Ministry of Defence (British Army), Somerset Constabulary & the Metropolitan Police Force in London, in Retailing IT with Debenhams & MFI Warehouses, in Transport & Logistics IT & Consulting with PWC, Unilever, P&O Containers and the Port of Melbourne Authority; and Telecommunications & IT Systems Integration with both Telstra & Optus Communications, plus AT&T, EDS and UCSL.

This webinar will focus on the cultural shift from tightly controlled business networks of yesterday to the converged fabric adopted by businesses today. BYOD is becoming a normality for most organisations and it doesn't have to be a heavy burden for security teams with the right policies, people and technology in place. We'll dive into some of the options available for these challenges in this webinar and how having the right BYOD strategy can play an integral role in an organisation's preparation for EU GDPR compliance.

We’ll address:
- The security options available today to enable an efficient and safe BYOD strategy
- How implementing a strong BYOD strategy can help compliance
- How you can reduce the risk of suffering a damaging cyber-breach

Cross-platform frameworks, such as Apache Cordova, Adobe PhoneGap, or SAP Kapsel are becoming increasingly popular. They promote the development of hybrid apps that combine native, i.e., system specific, code and system independent code, e.g., HTML5/JavaScript. Combining native with platform independent code opens Pandora's box: all the security risks for native development are multiplied with the security risk of web applications.

In this talk, we will give a short introduction into hybrid app development, present specific attacks and discuss how Android developers are using Apache Cordova. In the second half of the talk, we will focus on the secure development of hybrid apps: both with hands-on guidelines for defensive programming as well as recommendations for hybrid app specific security testing strategies.

Speaker bio:

Dr. Achim D. Brucker (https://www.brucker.ch) leads the Software Assurance & Security Research Team (https://logicalhacking.com) at the University of Sheffield, UK. Until December 2015, he was a Security Testing Strategist in the Global Security Team of SAP SE, where, among others, he defined the risk-based security testing strategy of SAP. He is a frequent speaker at security conferences.

Are we filling our homes and carrying around in our pockets, our biggest cybersecurity vulnerabilities? Join us in a lively debate where we will discuss the increase in IoT and smart devices, some of the lesser talked about threats and what steps are being taken to reduce the risk to the imminent smart device mutiny of future.

We live in the age of high-profile breaches and cyber attacks. Every organization is a target, especially in the financial, healthcare and government space. With so much at stake in the event of a breach, what are the biggest cybersecurity risks for organizations? How should we defend against them?

This live panel will discuss:
- The relationship between identity, security and privacy
- The role of data security regulation
- Why investing in cybersecurity is key
- The few basic things organizations should be doing today to better secure their customer data

Enterprises, businesses, government agencies, transportation systems, hospitals, and in some cases, even power plants worldwide have been affected by the high-profile cyber attacks of 2017. What is the current state of digital identity, cyber security and privacy in an age of increased cyber attacks. With the EU General Data Protection Regulation (GDPR), going into effect in May 2018, how are global enterprises and businesses preparing for it?

Join this panel of expert identity and cybersecurity leaders as they discuss the pressing issues concerning identity and security, especially in the context of ransomware attacks, rise in cybercrime and instances of cyber warfare.

Attackers’ love for PowerShell is now no longer a secret, with 2016 producing an explosion in offensive PowerShell toolsets. PowerShell is gaining respect in offensive circles as “Microsoft’s Post-Exploitation Language” and being integrated into many offensive toolkits. Unfortunately, the offensive community often fails to research or share relevant mitigations with their defensive counterparts. This leaves many defenders without the information they need to protect themselves and their networks from these attacks. In a quest to combat the perceived threat, many defenders attempt to disable PowerShell rather than realizing its defensive potential.

In this webinar, Will Schroeder (@harmj0y) and Jared Atkinson (@jaredcatkinson) will cover offensive and defensive PowerShell tools and techniques, including PowerPick, subversive PowerShell profiles, PowerForensics, and Get-InjectedThread. They will also cover mitigations and detections for popular offensive tools and techniques, demonstrating how to best handle the new offensive reality of widespread offensive PowerShell usage.

Today’s IT risk environment is more threatened than ever thanks to the growth in sophisticated cyber attacks and security vulnerabilities. Now, complex, hard-to-detect attacks could bring down not just a single institution but also large parts of the internet and the financial markets. Organizations need an intelligent approach when it comes to assessing IT risk and managing compliance.

Staying safe is no longer just about deflecting attackers. It’s about staying ahead of attackers who are already inside the organization, and banks are doing this through structured lines of defense that enhance security capabilities, involve IT risk managers in operations, and expand internal audits mandate so they can cover business disruption. On this webinar presentation we will address some ways how organizations can as a part of an Integrated Risk Management initiative orchestrate effective IT risk management across the lines of defense.

The same-origin policy (SOP) remains one of the most important security mechanisms of the web, protecting servers from malicious pages interacting with their APIs through cross-site requests. However, the subtle details of the policy can be overlooked, so our talk aims to show how limitations in the application of the same-origin policy can undermine security.

Join this talk in the "Threat Hunting" series as David Petty, Network Security Analyst at Independent Security Evaluators, explains in depth how the same-origin policy works and how it can be bypassed to exploit cross-site vulnerabilities, including examples of Java, Flash, Silverlight, and Cross-Origin Resource Sharing (CORS) misconfigurations.

As the same-origin policy and cross-site request forgery (CSRF) are inherently connected, we will also show both simple and complex cross-site request forgery attacks and how CSRF functions within the context of the same-origin policy. This will include classic CSRF attacks that work within the confines of the same-origin policy and more complicated attacks that utilize server misconfigurations to bypass the same-origin restrictions altogether.

About the Threat Hunter:
David Petty is an Associate Security Analyst at Independent Security Evaluators (ISE), a security consulting company in Baltimore, MD. He has recently graduated from Northwestern University with a B.S. in Computer Science, and discovered his interest in security while working for ISE during college. He specializes in breaking web and native applications and uses these skills to conduct custom security assessments of software products. His interests also include reverse engineering and digital forensics.

In this episode of the Threat Hunting series we will feature a network security tool developed and used by real-life threat hunters. Sweet Security is a network security monitoring and defensive tool which can be deployed on hardware as small as a Raspberry Pi.

Using the power of Bro IDS and threat intelligence feeds, malicious network traffic can be exposed. This data is gathered and visualized with the ELK stack (Elasticsearch, Logstash, and Kiban). Going beyond detection, the device can implement blocking for specific devices on a granular level. Sweet Security can monitor all network traffic with no infrastructure change and block unwanted traffic. It ships with Kibana dashboards, as well as a new web administration UI. Even better, the installation can be separated between web administration and sensor.

Want to deploy the web administration to AWS and install a dozen sensors? No problem! With the ability to intercept all network traffic combined with the power of Bro and ELK, you can unlock the ability to hunt for threats across any environment.

Travis Smith will go through how the tool works, as well as some interesting findings he has discovered on his own home network.

In this webinar, you’ll learn about how to architect and embed strong cybersecurity controls such as: secure boot, multi-factor authentication, secure software updates, secure communications between industrial devices (PLCs, sensors, IEDs, RTUs and controllers), gateways and industrial clouds. You’ll also learn about how to enable applications to call cryptographic functions that leverage hardware secure elements such as TPM, SGX, TrustZone as well as HSMs and SIMs.

This channel features presentations by leading experts in the field of information security. From application, computer, network and Internet security to access control management, data privacy and other hot topics, you will walk away with practical advice for your strategic and tactical information security initiatives.